Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

secure_headers

3 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 3 medium
Registry
RubyGems

Advisories 3

  • CVE-2026-54163Medium 4.7

    secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

    Affected: fixed in 7.3.0.

  • CVE-2020-5216Medium 4.4

    Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

    Affected: from 6.0.0, fixed in 6.3.0; from 5.0.0, fixed in 5.2.0; fixed in 3.9.0.

  • CVE-2020-5217Medium 4.4

    Directive injection when using dynamic overrides with user input in RubyGems secure_headers

    Affected: from 6.0.0, fixed in 6.2.0; from 5.0.0, fixed in 5.1.0; fixed in 3.8.0.